Vulnerability Coordination Retrospective: Cosmos Mainnet Security Advisory Magenta, 09-30-2019
On Friday, September 20th a high-severity security vulnerability in Tendermint that impacted all versions of Tendermint was reported through the Tendermint Bug Bounty program. The issue was reported at 7:27 UTC, with triage beginning immediately among core development teams who were operating in North America and Europe. The Bug The vulnerability that was reported demonstrated a flaw in Tendermint logic that, when exploited, could cause a remote panic. This bug could allow for a malicious attacker who sent a nil public key during a handshake to crash the application. Because Tendermint did not validate remote public keys in the handshake process, this vulnerability would have allowed for an attacker to carry out a Denial of Service attack against public sentry nodes on Tendermint-powered networks. github.com tendermint/tendermint/blob/8fbc62563ed43b5d69e7ca73a4ff4247c841630e/p2p/conn/secret_connection.go#L136 ``` // Sign the challenge bytes for authentication. locSignature := signChallenge(challenge, locPrivKey) // Share (in secret) each other's pubkey & challenge signature authSigMsg, err := shareAuthSignature(sc, locPubKey, locSignature) if err !=…
Excerpt (1197 of 8778 characters). Read the whole post on the forum ↗
Update for Cosmos Mainnet Security Advisory Magenta On Wednesday, October 9 a high-severity security vulnerability in Tendermint that impacted the security patch released in Tendermint versions 0.31.9 and 0.32.5, and Cosmos SDK version 0.34.8 was reported through the Tendermint Bug Bounty program. This issue was reported at 3:31 UTC, with triage beginning immediately among core development teams who were operating in North America, Europe, and Japan. The Bug In the patch for Cosmos Mainnet Security Advisory Magenta, the core development team initially chose the simpler of two options outlined in the initial advisory to remediate the code flaw that would have enabled an attacker to launch a Denial of Service attack against public sentry nodes on the Cosmos Network. In `Secret_connection.go` at line 126 in v. 0.31.9 of Tendermint, a nil check was used where a type assertion was required per best practices in Go, and the handler was not wrapped in a panic rescuer to prevent the nodes from panic. Investigation and Response Within a couple of hours of cutting the initial security release, core developers discussed the first patch for the issue and had identified the risk…
Excerpt (1196 of 3603 characters). Read the whole post on the forum ↗